Network Intrusion Detection Systems (“NIDS”) are typically designed to monitor network activity in real-time to spot suspicious or known malicious activity and to report these findings to the appropriate personnel. By keeping watch on all activity, NIDS have the potential to warn about computer intrusions relatively quickly and allow administrators time to protect or contain intrusions, or allow the NIDS to react and stop the attack automatically.
As the market for intrusion detection moves toward maturity it begins to demand intrusion prevention. Current technology does not allow for foolproof application of blocking policies based on signature detection alone. In order for customers to apply prevention policies based on detection of potential malicious activity on the network, the issue of false positives or benign triggers must be addressed. False positives may occur, for example, when a known signature is detected but that signature has no potential impact on a particular computer system.